DIACAP_Bridge_J_A_Redacted.pdf

FOR OFFICIAL USE ONLY

Justification and Approval (J&A) for Other Than Full and Open Competition l NOTE: If a Justification and Approval was approved for the preceding acquisition, a copy of the approved J&A for the predecessor action I I must be Included In the staff package for approval of the Instant J&A. This applies to J&A staff packages that are submitted for review I I and approval at a level above the contracting officer. The predecessor J&A wlll be used as a reference document by the approving official. I I

I L----------------------------------------------------------------------------------

Is this a new or amended J&A Document? � New D Amended ( Prior to Award Only!)

Is this a Bridge Action as defined in the AF Bridge Action Reduction Plan? � Yes D No Funding level for this acquisition:

Contracting Activity: 338 SCONS/PKD, 2021 First Street West, JBSA-Randolph TX 78150-4302 Purchase Request/ Local ID Number: FA3002-18-R-0016

P / P , t ( d PE if Ii bl ) DIACAP, RMF, eMASS and related Cybersecurity Support & Consolidated Tasker rogram roJec an , app ca e : S rt uppo

Program Type (PEO or other Contracting): Other Contracting Authority: 6.302-1 - 10 USC 2304(c)(1), Only One Responsible Source and No other Supplies or Services WIii Satisfy Agency Requirements

Estimated Contract Cost (including options): J&A Type: D Class � Individual

COORDINATION CAFFARS 5306,304(a))

Date

01 May2018

Date

03 May2018

Date

04 May 2018

Date

Project Lead / Program Mgr / Requiring Activity

Requiring Activity's General Officer (GO)

Contracting Officer

Local Legal Reviewer

Date Chief of the Contracting Office (COCO)

L.( /VV'<� l 'i, O

March 2018

Signature

Signature

Signature

Signature

FOR OFFICIAL USE ONLY

APPROVAL (AFFARS 5306.304(a))

Date

March 2018

Competition Advocate

I. Contracting Activity.

338 SCONS/PKDB, 2021 First Street West, JBSA-Randolph AFB, TX 78150-4302

II. Nature and/or description of the action being processed.

This Justification and Approval (J&A) is submitted to gain approval to award a short term, firm-fixed-price (FFP) contract to Diligent Consulting, Inc. for conti.nued mission support of the AETC DoD Information Assurance Certification and Accreditation Program (DIACAP). This contract will succeed contract FA3002-17-C-0011, which was awarded non-competitively to Diligent Consulting as a FFP, 6-month bridge contract with a period of performance of 12 May 17 - 10 May 18.

In April 2017, the follow-on competitive source selection to DIACAP contract FA3002-11-D-0003 received a pre-award protest, challenging the Government's use of the Lowest Price Technically Acceptable (LPTA) contracting method. To prevent a break in DIACAP support to AETC, a one year bridge contract was awarded to the incumbent contractor to continue services until which time a follow-on contract could be put in place.

GAO accepted cancellation of the LPTA solicitation as corrective actions and the protest was ultimately sustained.

Within the following months, the requirement began to change. AETC needed to realign their requirement with at the time, both current industry and Air Force (AF) requirements. AF procedural and AETC systems updates were made, as well as the inclusion of a required third task area, an on-site Portfolio Manager (PfM), to support AETC IT Portfolio Management data collection, reporting, and activities. Updates and additions, changes in the Performance Work Statement (PWS), and an inability to fully determine the complete scope of the AF requirement, led to the option to extend services being exercised on 6 Nov 17 for an additional six months with a contract expiration date of 1 O May 18.

On 9 Mar 18, a combined synopsis/solicitation for the long-term follow-on contract to FA3002-17-C-0011 was posted to www.fbo.gov under solicitation FA3002-18-R-0006 as a Service Disabled Veteran-Owned Small Business (SDVOSB) set aside with a closing date of 9 Apr 18. In response to the previous protest, the Government changed the contracting method from LPTA to best value using the trade-off process, and changes to the original acquisition strategy, evaluation factors and sub-factors, and the subsequent solicitation were made. The solicitation, now requiring the submission of past performance information, required a number of changes to the Past Performance Questionnaire.

The PPQ changes coupled with an unprecedented number of questions and comments from industry, and the expectation of an extremely high number of proposals, initiated the extension of the RFP due date to 18 Apr 18.

The source selection process has begun, and given that the follow-on acquisition is utilizing the best value source selection process in which Technical, Past Performance and Pricing will all be considered, coupled with the high number of proposals received, it is unlikely that the Government can execute a fair and balanced, comparative assessment of all proposals in time to make award prior to 10 May 18, which makes this bridge effort necessary. The short-term contract will be comprised of a 4-month base period with two 4-month options that will run from 11 May 18

- 1 O May 19. It is not the Government's intent to utilize more months than is necessary to complete the current source selection process; however, award will include FAR 52.217-8, Option to Extend Services clause to provide the flexibility needed to address any further delays should they arise.

The Air Force (AF) needs to award a short-term contract to ensure continued service until a follow-on contract can be awarded.

Ill. Description of supplies/services required to meet agency needs.

The required services cover two distinct areas. First, a team of Cybersecurity Professionals at the system level working in the IT Infrastructure Library (ITIL)/Defense Enterprise Services Management Framework (DESMF), Information Security Management (ISM) Process to complete tasks such as Assessment and Authorization (A&A) under the DoD, Air Force and AETC implementation of the Risk Management Framework (RMF), Information System Security Manager (ISSM) and Cybersecurity Workforce Management. Second, a team of Cybersecurity Professionals required to operate as

March 2018 Page 3 of 5 the Approving Official's (AO) Support Staff working in the HQ AETC/A6 Cybersecurity Office (also known as AETC ITSP Risk Management Function) to complete tasks such as Security Control Validation, Enterprise Mission Assurance Support Service (eMASS) Account Management and Federal Information Systems Management Act (FISMA) compliance. While the tasks to be performed on this contract are commercial checklist driven administrative functions, continued processing of DIACAP Cybersecurity packages without interruption to the certification process could be interrupted or stopped if this sole source contract is not awarded.

IV. Statutory authority permitting other than full and open competition.

10 U.S.C. 2304(c)(1) as implemented by FAR 6.302-1, Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.

V. Demonstration that the contractor's unique qualifications or nature of the acquisition requires the use of the authority cited above (applicability of authority), The current task order expires on 1 O May 18 with no further extensions available on the contract. The follow-on requirement will not be awarded in time to prevent a service interruption. A sole source contract awarded to the incumbent contractor is the only viable way to continue processing DIACAP Cybersecurity packages without interruption to the certification process.

Diligent Consulting, Inc. has been providing Cybersecurity DIACAP support services to AETC for the past six years under contracts FA3002-11-D-0003 and FA3002-17-C-0011, as a result of a competitively awarded contract among SDVOSBs issued on 12 Nov 10 and a sole-source, short-term bridge contract, respectively. Diligent is intimately involved with all ongoing DIACAP packages and have a ready force of personnel with the required security clearances, training, and certifications needed already in place. Awarding a sole-source contract to the incumbent contractor will allow the Government to utilize the established workforce to support the AETC Cybersecurity mission without a mission impact until the follow-on requirement can be awarded.

Award to any other source would result in an unacceptable delay in processing AETC DIACAP packages as another source would require time to recruit, hire, train, and secure necessary clearances for personnel. New personnel would also need time to familiarize themselves with AETC processes, catch up on any backlog of packages created during the training process, and sustain current workload. Due to the nature of this short-term contract and the aforementioned factors, there is no recognized benefit to the Government in competition as it is likely that day-to-day operations will be adversely effected.

Accordingly, given the current time-line and short period of performance of this sole source effort, Diligent Consulting, Inc. is the only firm capable of providing the services described in Section Ill above without AETC experiencing unacceptable delays and performance gaps in fulfilling its Cybersecurity requirements for AETC Information Systems.

VI. Description of efforts made to ensure that offers are solicited from as many potential sources as practicable.

Market research was conducted on 26 Jan 17 for the follow-on acquisition, which included like services as required for this effort; because the market research is still current, and in accordance with (IAW) FAR 10.002(b)(1), no additional market research was conducted. On 24 Apr 18, the Government released a synopsis for this requirement on the Government Point of Entry (Federal Business Opportunities website at www.fbo.gov) indicating the Government's intention to award a sole-source, FFP contract to Diligent Consulting. The Government required all interested persons to identify to the Contracting Officer their intent and capabilities to satisfy the Government's requirement within 8 calendar days from the synopsis publication date. The Government will consider any responses received prior to awarding the sole source contract.

VII, Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer (CO) has determined this to be a commercial service IAW FAR 2.101; therefore, certified cost or pricing data are not required. A fair and reasonable price will be determined by using price analysis techniques per FAR 15.404, which include comparing proposed prices for the sole source effort to the competitively awarded prices paid

March 2018 Page4 of 5

Justification and Approval (J&A) for Other Than Full and Open·Competition under FA3002-11-D-0003. Additional comparison of proposed pricing will be done using commercial market pricing for the same or similar labor categories used to fulfill this requirement. However, if during the evaluation, the CO cannot clearly determine that the price is fair and reasonable, the CO may request data other than certified cost or pricing data to the extent necessary to arrive at a fair and reasonable price.

VIII. Description of the market research conducted and the results, or a statement of the reasons market research was not conducted.

As described in Section VI above, market research, in accordance with FAR Part 10, was conducted on 26 Jan 17 for the follow-on acquisition, which included like services as required for this effort. In addition, a synopsis of this proposed acquisition was issued, advising industry of the pending acquisition and soliciting inquiries from interested parties.

IX. Any other facts supporting the use of Other Than Full and Open Competition.

See Sections Ill and V above.

X. List of any sources that expressed, in writing, an interest in the acquisition.

None to date.

XI. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before making subsequent acquisitions for the supplies or services required.

All options for the current contract bridge effort have been exercised. This sole source contract is a temporary solution that will ensure that the processing of DIACAP packages will continue during the source selection process, and until contract award for the follow-on can be made.

XII. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

XIII. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.

March 2018 Page 5 of 5